Ensuring patient engagement that is HIPAA compliant